Set a CSP header on all attachments
authorMagnus Hagander <magnus@hagander.net>
Mon, 1 Dec 2025 17:45:01 +0000 (18:45 +0100)
committerMagnus Hagander <magnus@hagander.net>
Mon, 1 Dec 2025 17:45:01 +0000 (18:45 +0100)
django/archives/mailarchives/views.py

index c1118ac69cd506805285732a52c6848cce731124..fe74f7cd4d94d0963a9a83add7defb9ca5d9d265 100644 (file)
@@ -395,6 +395,7 @@ def attachment(request, attid):
 
     return HttpResponse(bytes(r[0][3]), content_type=r[0][1], headers={
         'X-attached-to-message': r[0][2],
+        'Content-Security-Policy': "default-src 'none'",
     })